Re: [DISCUSS] release a new Meecrowave version tomorrow?

2022-12-20 Thread Jean-Baptiste Onofré
I guess 3.5.5 which includes some CVE fixes.

Regards
JB

Le mar. 20 déc. 2022 à 21:20, Romain Manni-Bucau  a
écrit :

> Hi Mark,
>
> Do you mean 4.0.0 ir 3.5.5?
> Seems not done on master but we need to check deps  chnages before since we
> must exclude most of them in general with cxf heterogeneous tree.
>
> Romain
>
>
>
> Le mar. 20 déc. 2022 à 21:10, Mark Struberg  a
> écrit :
>
> > I'd like to roll the release for a new Meecrowave version tomorrow with
> an
> > updated CXF.
> >
> > You've got about 12h to stop me ;)
> >
> > txs and LieGrue,
> > strub
> >
> >
>


[jira] [Commented] (OWB-1416) Possible misintepretation of spec regarding Unproxyable bean types

2022-12-20 Thread Mark Struberg (Jira)


[ 
https://issues.apache.org/jira/browse/OWB-1416?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17650004#comment-17650004
 ] 

Mark Struberg commented on OWB-1416:


I agree with Romain that a) the spec is not clear and b) our approach is much 
more safe.
Consider some code accessing the Contextual Reference via Instance or 
BeanManager.getContextualReference() etc. In that case there is not even an 
injection point. Does this mean Weld will serve broken CDI beans out to user 
code? Sounds really wrong to me.

> Possible misintepretation of spec regarding Unproxyable bean types
> --
>
> Key: OWB-1416
> URL: https://issues.apache.org/jira/browse/OWB-1416
> Project: OpenWebBeans
>  Issue Type: Bug
>Reporter: Alexander Larsen
>Priority: Major
>
> OWB seems to throw an exception for all unproxyable normal scoped beans. I 
> think that this might be incorrect.
> The 
> [specification|https://docs.jboss.org/cdi/spec/2.0/cdi-spec.html#unproxyable] 
> says the "A bean type must be proxyable if an injection point resolves to a 
> bean", not that all the types of the bean must be proxyable. In other words, 
> as long as the bean is a legal bean, and all injection point resolving to 
> this bean is a proxyable type - no exception should be thrown.
> In the part about [contextual 
> references|https://docs.jboss.org/cdi/spec/2.0/cdi-spec.html#contextual_reference],
>  there is further indications that unproxyable types should be allowed in the 
> set of types for the bean. It's only when you try to get a reference(injected 
> or by bean manager) to an unproxyable type, and the bean must be proxied 
> (normal scoped, intercepted or decorated) an exception should thrown.
> Also, the [Weld user guide suggests introducing an interface as a solution to 
> having an unproxyable 
> bean|https://docs.jboss.org/weld/reference/latest/en-US/html_single/#_client_proxies].
> The current OWB implementation makes a pattern of having an interface and 
> (one or more) implementation class with final fields/methods somewhat 
> difficult :)



--
This message was sent by Atlassian Jira
(v8.20.10#820010)


Re: [DISCUSS] release a new Meecrowave version tomorrow?

2022-12-20 Thread Romain Manni-Bucau
Hi Mark,

Do you mean 4.0.0 ir 3.5.5?
Seems not done on master but we need to check deps  chnages before since we
must exclude most of them in general with cxf heterogeneous tree.

Romain



Le mar. 20 déc. 2022 à 21:10, Mark Struberg  a
écrit :

> I'd like to roll the release for a new Meecrowave version tomorrow with an
> updated CXF.
>
> You've got about 12h to stop me ;)
>
> txs and LieGrue,
> strub
>
>


[DISCUSS] release a new Meecrowave version tomorrow?

2022-12-20 Thread Mark Struberg
I'd like to roll the release for a new Meecrowave version tomorrow with an 
updated CXF.

You've got about 12h to stop me ;)

txs and LieGrue,
strub